From 92b95f66d7e20cfe44e17db5e2b3491639bcef69 Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Mon, 28 Oct 2024 16:47:40 +0100 Subject: [PATCH] fix: added s3 origin comprobation in `cloudfront_distributions_s3_origin_non_existent_bucket` (#5545) Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com> --- ...stributions_s3_origin_non_existent_bucket.metadata.json | 4 ++-- ...oudfront_distributions_s3_origin_non_existent_bucket.py | 7 ++++--- ...ont_distributions_s3_origin_non_existent_bucket_test.py | 1 + 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/prowler/providers/aws/services/cloudfront/cloudfront_distributions_s3_origin_non_existent_bucket/cloudfront_distributions_s3_origin_non_existent_bucket.metadata.json b/prowler/providers/aws/services/cloudfront/cloudfront_distributions_s3_origin_non_existent_bucket/cloudfront_distributions_s3_origin_non_existent_bucket.metadata.json index 5910db0594..2227c18d65 100644 --- a/prowler/providers/aws/services/cloudfront/cloudfront_distributions_s3_origin_non_existent_bucket/cloudfront_distributions_s3_origin_non_existent_bucket.metadata.json +++ b/prowler/providers/aws/services/cloudfront/cloudfront_distributions_s3_origin_non_existent_bucket/cloudfront_distributions_s3_origin_non_existent_bucket.metadata.json @@ -1,7 +1,7 @@ { "Provider": "aws", "CheckID": "cloudfront_distributions_s3_origin_non_existent_bucket", - "CheckTitle": "CloudFront distributions should not point to non-existent S3 origins.", + "CheckTitle": "CloudFront distributions should not point to non-existent S3 origins without static website hosting.", "CheckType": [ "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls" ], @@ -10,7 +10,7 @@ "ResourceIdTemplate": "arn:partition:cloudfront:region:account-id:distribution/resource-id", "Severity": "high", "ResourceType": "AwsCloudFrontDistribution", - "Description": "This control checks whether Amazon CloudFront distributions are pointing to non-existent Amazon S3 origins. The control fails if the origin is configured to point to a non-existent bucket.", + "Description": "This control checks whether Amazon CloudFront distributions are pointing to non-existent Amazon S3 origins without static website hosting. The control fails if the origin is configured to point to a non-existent bucket.", "Risk": "Pointing a CloudFront distribution to a non-existent S3 bucket can allow malicious actors to create the bucket and potentially serve unauthorized content through your distribution, leading to security and integrity issues.", "RelatedUrl": "https://docs.aws.amazon.com/whitepapers/latest/secure-content-delivery-amazon-cloudfront/s3-origin-with-cloudfront.html", "Remediation": { diff --git a/prowler/providers/aws/services/cloudfront/cloudfront_distributions_s3_origin_non_existent_bucket/cloudfront_distributions_s3_origin_non_existent_bucket.py b/prowler/providers/aws/services/cloudfront/cloudfront_distributions_s3_origin_non_existent_bucket/cloudfront_distributions_s3_origin_non_existent_bucket.py index 1ba7fc41b1..d671fac4e8 100644 --- a/prowler/providers/aws/services/cloudfront/cloudfront_distributions_s3_origin_non_existent_bucket/cloudfront_distributions_s3_origin_non_existent_bucket.py +++ b/prowler/providers/aws/services/cloudfront/cloudfront_distributions_s3_origin_non_existent_bucket/cloudfront_distributions_s3_origin_non_existent_bucket.py @@ -19,9 +19,10 @@ class cloudfront_distributions_s3_origin_non_existent_bucket(Check): non_existent_buckets = [] for origin in distribution.origins: - bucket_name = origin.domain_name.split(".")[0] - if not s3_client._head_bucket(bucket_name): - non_existent_buckets.append(bucket_name) + if origin.s3_origin_config: + bucket_name = origin.domain_name.split(".")[0] + if not s3_client._head_bucket(bucket_name): + non_existent_buckets.append(bucket_name) if non_existent_buckets: report.status = "FAIL" diff --git a/tests/providers/aws/services/cloudfront/cloudfront_distributions_s3_origin_non_existent_bucket/cloudfront_distributions_s3_origin_non_existent_bucket_test.py b/tests/providers/aws/services/cloudfront/cloudfront_distributions_s3_origin_non_existent_bucket/cloudfront_distributions_s3_origin_non_existent_bucket_test.py index 127ea69906..48d352d114 100644 --- a/tests/providers/aws/services/cloudfront/cloudfront_distributions_s3_origin_non_existent_bucket/cloudfront_distributions_s3_origin_non_existent_bucket_test.py +++ b/tests/providers/aws/services/cloudfront/cloudfront_distributions_s3_origin_non_existent_bucket/cloudfront_distributions_s3_origin_non_existent_bucket_test.py @@ -54,6 +54,7 @@ class Test_cloudfront_s3_origin_non_existent_bucket: id="S3-ORIGIN", origin_protocol_policy="", origin_ssl_protocols=[], + s3_origin_config={"OriginAccessIdentity": ""}, ), ], )